@mohasinac/appkit 4.42.15 → 4.42.17

package/dist/_internal/server/features/checkout/locked-lines.js

@@ -22,6 +22,7 @@
  * @tag sideEffects:firestore-write
  */
 import { offerRepository } from "../../../../features/seller/repository/offer.repository";
+import { cartRepository } from "../../../../features/cart/repository/cart.repository";
 import { bidRepository } from "../../../../repositories";
 import { OfferStatusValues } from "../../../../features/seller/schemas";
 import { BID_COLLECTION } from "../../../../features/auctions/schemas/firestore";
@@ -199,7 +200,31 @@ export async function assertLockedLinesStillValid(items, buyerUid) {
             continue;
         const offer = await offerRepository.findById(item.offerId);
         if (!offer) {
-            throw new ValidationError("The offer for one of your items no longer exists. Remove it and try again.");
+            /*
+             * 🛑 PRUNE IT, do not just refuse. This used to throw "Remove it and
+             * try again" — an instruction the buyer cannot follow, because
+             * `cartRepository.removeItem` rejects any `locked` line and the cart
+             * page renders no remove control for one. Three guards then disagreed
+             * about one fact and trapped the buyer between them: checkout said
+             * remove it, remove said the line requires payment, and
+             * `assertCanAddNewItems` said settle the offer lane first — so the
+             * whole cart, including unrelated standard items, became unbuyable
+             * with no way out. Measured on production: three real items stranded
+             * behind one tombstone line.
+             *
+             * At THIS point the lock protects nothing. The lock exists so a buyer
+             * cannot walk away from a committed purchase; an offer record that no
+             * longer exists is not a commitment to anything, and the line can never
+             * be fulfilled. `removeItemsByOfferId` is the same path admin
+             * cancellation already uses, so it is allowed to clear a locked line.
+             *
+             * Still a ValidationError rather than a silent continue: the buyer's
+             * total just changed, and a checkout that quietly drops a line and
+             * charges a different amount than the screen showed is its own defect.
+             * They retry once and it goes through.
+             */
+            await cartRepository.removeItemsByOfferId(buyerUid, item.offerId);
+            throw new ValidationError("One item was removed because its offer no longer exists. Please review your cart and try again.");
         }
         if (offer.buyerUid !== buyerUid) {
             throw new ValidationError("This offer belongs to a different account.");

package/dist/_internal/server/features/digital-code/pool.js

@@ -21,6 +21,7 @@ import { normalizeError } from "../../../../errors/normalize";
 import { serverLogger } from "../../../../monitoring";
 import { ValidationError } from "../../../../errors";
 import { ORDER_FIELDS } from "../../../../constants/field-names";
+import { firestoreTimestampToDate } from "../../../../utils/type.converter";
 import { PRODUCT_COLLECTION, PRODUCT_CODES_SUBCOLLECTION, } from "../../../../features/products/schemas/firestore";
 /**
  * Where a delivered asset's bytes live.
@@ -181,8 +182,28 @@ export async function listPoolEntries(productId) {
             status: c.status,
             ...(c.fileName ? { fileName: c.fileName } : {}),
             ...(c.orderId ? { orderId: c.orderId } : {}),
-            ...(c.claimedAt ? { claimedAt: new Date(c.claimedAt).toISOString() } : {}),
-            ...(c.createdAt ? { createdAt: new Date(c.createdAt).toISOString() } : {}),
+            /*
+             * 🛑 firestoreTimestampToDate, never `new Date(value)`.
+             *
+             * addPoolEntries writes `createdAt: new Date()`, and the Admin SDK stores
+             * that as a Firestore Timestamp and reads it back as one — NOT as a Date.
+             * `new Date(aTimestamp)` is an Invalid Date, and `.toISOString()` on an
+             * Invalid Date THROWS RangeError, so this map took the whole route down
+             * with a 500.
+             *
+             * It hid for as long as it possibly could: mapping over ZERO documents
+             * never throws, so GET answered `[]` for the entire period the pool had
+             * no writer (Root Cause #103) and only began failing once the first entry
+             * existed. The seller then saw "Nothing in the pool yet" — the component
+             * rendering a failed load as an empty state — and the rational response
+             * is to add the codes again, which silently accumulates duplicates.
+             */
+            ...(c.claimedAt
+                ? { claimedAt: firestoreTimestampToDate(c.claimedAt).toISOString() }
+                : {}),
+            ...(c.createdAt
+                ? { createdAt: firestoreTimestampToDate(c.createdAt).toISOString() }
+                : {}),
         };
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.42.15",
+  "version": "4.42.17",
   "license": "MIT",
   "publishConfig": {
     "access": "public"